You want the pattern first, so here it is: ^[^\s@]+@[^\s@]+\.[^\s@]+$. It passes ada@example.com, ada+news@example.co.uk and o'brien@example.ie, and it stops ada@, ada example.com and ada@example. Those are the typos real people make in real forms.
Stricter patterns look safer and turn away paying customers. A pattern that only allows letters, digits and a few symbols before the at-sign blocks legal addresses with an apostrophe or a plus sign. Our answer on regex covers why the full RFC grammar is the wrong target too.
The steps below take you from the pattern to a check that tells you whether the mailbox is real, which is the part a regex can't see.
The short version
- The form field or import script where addresses come in
- A ZapBounce API key for the mailbox check (100 free checks a month, no card)
The steps
Pick the permissive pattern
Use
^[^\s@]+@[^\s@]+\.[^\s@]+$. It means one or more characters that are not a space or an at-sign, then one at-sign, then a domain with at least one dot. Anchor it at both ends so a stray space before or after the address fails.Add the length rules
Cap the whole address at 254 characters and the part before the at-sign at 64. A regex can do this, but a plain length check is easier to read and easier for the next developer to change.
Drop it into your language
In JavaScript,
/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email). In Python,re.fullmatch(r"[^\s@]+@[^\s@]+\.[^\s@]+", email). In PHP you can skip the regex and callfilter_var($email, FILTER_VALIDATE_EMAIL), which is stricter but well tested. The JavaScript guide walks through the browser side in full.Trim before you test
Strip leading and trailing spaces, then lower-case the domain part only. Pasted addresses often carry a trailing space, and failing someone for that feels broken to them.
Offer a typo fix instead of a red border
A pattern passes
ada@gmial.combecause it is well formed. Our API returns adid_you_meansuggestion for typos like that, and your form can offer it before the person moves on.Check the mailbox after the pattern passes
Send the address to
POST /v1/verify. We look up the domain's MX record, open an SMTP connection on port 25, ask about the mailbox atRCPT TOand close before any message is sent. You get one of four results:valid,invalid,catch_allorunknown. See the API page for the full response.
Three patterns and what each one lets through
The permissive pattern above is the one to ship. It lets through every address a person can actually own, and it rejects the obvious mistakes. You'll see a few odd strings pass, such as a@b.c, and the mailbox check handles those.
The common strict pattern, ^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$, shows up in a lot of old tutorials. It rejects an apostrophe in the local part, so o'brien@example.ie fails. Use it only if you control every address, such as a staff directory.
The browser's own rule for type="email" fields sits between the two. It follows the HTML standard, accepts plus signs and apostrophes, and doesn't require a dot in the domain. That's fine for a first pass in a form.
What a regex can never tell you
A regex has no network access. It can't see whether the domain exists, whether the domain publishes a mail server, or whether that server accepts this person. A perfectly shaped address at a domain that expired last year passes every pattern you can write.
Those three questions are what the ZapBounce check answers. A syntax reject in a batch comes back as invalid with the reason invalid_syntax and costs no credit, because we never had to ask a mail server. You pay only when we asked a server and got an answer, and an unknown is never billed.
Pricing is on one page: $5 for 1,000 checks and $25 for 10,000, and credits never expire. Read the pricing page for the full ladder.
Questions people ask
What is the simplest email regex that works?
The simplest one that works is ^[^\s@]+@[^\s@]+\.[^\s@]+$ with a 254-character length cap. It needs one at-sign, no spaces and a dot in the domain. It accepts plus signs and apostrophes, which stricter patterns wrongly reject.
Should an email regex allow plus signs?
Yes. A plus sign is legal in the local part, and many people use addresses like ada+shop@example.com to filter mail. A pattern that blocks the plus sign turns those people away at your form.
Is there a regex that matches RFC 5322 exactly?
Patterns that attempt the full RFC 5322 grammar run to thousands of characters and still say nothing about whether the mailbox exists. A short permissive pattern plus an SMTP mailbox check gives a far better result in about 30 characters.
Does regex validation cost anything at ZapBounce?
No. A row that fails on syntax alone comes back as invalid with the reason invalid_syntax and is never billed. Credits are spent only when ZapBounce asks a mail server about the address and gets an answer.